To: 


Of: 


ico. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Just Hype Ltd 


Suite 2 Rosehill, 165 Lutterworth Road, Blaby, Leicester, LE8 4DY 


The Information Commissioner (“Commissioner”) has decided to issue 
Just Hype Ltd (“Just Hype”) with a monetary penalty under section 55A 
of the Data Protection Act 1998 (“DPA”). The penalty is in relation to a 
serious contravention of Regulation 22 of the Privacy and Electronic 
Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


Just Hype, whose registered office is given above (Companies House 
Registration Number: 07967928) is the organisation stated in this 
notice to have instigated the transmission of unsolicited 
communications by means of electronic mail to individual subscribers 


for the purposes of direct marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 122(5) of the DPA 2018 defines direct marketing as “the 
communication (by whatever means) of advertising material which is 
directed to particular individuals”. This definition also applies for the 


purposes of PECR (see regulation 2(2) PECR; and Schedule 19, 
paragraph 430 and 432(6) DPA18). 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail’ is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in 
Regulation 22(3) of PECR. In essence, an organisation may be able to 
e-mail its existing customers even if they haven't specifically consented 


to electronic mail. 


Section 55A of the DPA (as amended by the Privacy and Electronic 


Communications (EC Directive)(Amendment) Regulations 2011 and the 
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Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 
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The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


Phone users can report the receipt of unsolicited marketing text 
messages to the GSMA’s Spam Reporting Service by forwarding the 
message to 7726 (spelling out “SPAM”). The GSMA is an organisation 
that represents the interests of mobile operators worldwide. The 
Commissioner is provided with access to the data on complaints made 
to the 7726 service and this data is incorporated into a Monthly Threat 


Assessment (MTA) used to ascertain organisations in breach of PECR. 


Just Hype is a fashion brand primarily aimed at the youth market. It 
first came to the attention of the Commissioner following a number of 
complaints being received via the 7726 reporting tool over a 4-day 
period between 7 June 2020 and 10 June 2020. The message received 


by individuals read: 


“Claim your free face mask now! no purchase required, download app 
to claim:- https://qrco.de/bbYNDZ .To opt out:- 
http://bit.ly/2V4wm0K” 


Following further investigation by the Commissioner a number of 
additional complaints to the 7726 reporting tool were discovered in 
respect of Just Hype between 1 June 2019 and 12 June 2020. 
Additional complaints were also discovered that had been sent to the 


Commissioner via her online reporting tool. 
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An initial investigation letter was sent to Just Hype on 12 June 2020 

raising some preliminary concerns with its PECR compliance and 

providing details of the complaints received. The correspondence also 

requested information about the volume of messages sent to 

subscribers, the sources of data for the recipients of those messages 

and any due diligence undertaken. Just Hype were warned that the 


Commissioner could issue civil monetary penalties of up to £500,000 
for PECR breaches. 


In its response of 3 July 2020 Just Hype assured the Commissioner 
that it had suspended all text message marketing on receipt of her 
correspondence. It stated that the marketing messages are sent 
through a third-party SMS messaging platform provider, with 
2,001,959 messages having been sent between 1 June 2019 and 12 
June 2020. Of this number 1,746,632 were received by subscribers. In 
respect of the free face mask messages, sent over the four-day period 
between 7 June 2020 and 10 June 2020, 107,795 messages were sent 
by Just Hype. In further correspondence it confirmed the bodies of all 
marketing messages sent which included further references to face 


masks and fashion masks. 


It stated the data had been sourced from its own website namely from 
its own customers during the checkout process when purchasing items. 
Just Hype acknowledged that having reviewed the checkout page it 
could have be clearer to customers about how their data would be used 
and how they could opt out of receiving marketing messages. The 
website page was therefore amended by Just Hype. The Commissioner 
therefore requested copies of the checkout page before and after being 


updated which were provided for review. 


In its correspondence with the Commissioner, Just Hype advised that it 
did not have any specific training in relation to contact with customers 
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for its staff, but this had been identified as an area for focus. It also did 
not have any written PECR policies and procedures in place. It had, 
however, updated its data protection policy to make specific reference 


to the requirements of PECR on receipt of the Commissioner’s 


correspondence, a copy of which was provided. 


Just Hype informed the Commissioner that its internal investigation 
into the complaints revealed an issue they had previously been 
unaware of with their SMS platform provider. The platform allows 
businesses to purchase credits to mass send marketing messages, and 
allows different distribution lists to be sent within one account. The 
individual IT consultant who had set up the account on their behalf also 
acted for several other businesses. Each business had its own 
distribution list contained within the one account. Just Hype had 
seemingly sent a number of messages to every user within the 
platform account that was being used by several companies rather 
than just to its own distribution list. Just Hype were asked to clarify 
what proportion of messages were sent to subscribers who were not 
Just Hype customers. The response indicated that of the 107,795 
messages sent between 7 June to 10 June 2020, 72.23% of the 
distribution list contained within the platform account belonged to Just 
Hype. As such 29,995 messages were mistakenly sent to incorrect 


recipients. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by Just Hype and, if so, 


whether the conditions of section 55A DPA are satisfied. 
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The contravention 


The Commissioner finds that Just Hype contravened regulation 22 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 1 June 2019 and 12 June 2020 
there were 1,746,632 direct marketing messages received by 
subscribers. The Commissioner finds that Just Hype instigated the 
transmission of the direct marketing messages sent, contrary to 
regulation 22 of PECR. 


The Commissioner is satisfied that the contravention could have been 
higher, with a total of 2,001,959 text messages being sent over the 


relevant time. 


Just Hype, as the instigator of the direct marketing, is required to 
ensure that it is acting in compliance with the requirements of 
regulation 22 of PECR, and to ensure that valid consent to send those 


messages had been acquired. 


Just Hype collected information for marketing purposes through its 
website checkout page relying on the ‘soft opt-in’ exemption provided 
by Regulation 22(3) PECR. This exemption means that organisations 
can send marketing messages by text and e-mail to individuals whose 
details had been obtained in the course or negotiation of a sale and in 
respect of similar products and services. The organisation must also 
give the person a simple opportunity to refuse or opt out of the 
marketing, both when first collecting the details and in every message 
after that. 
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The checkout page of Just Hype’s website contained an opt-out to 

marketing situated below the e-mail collection box that stated ‘keep 

me up to date on news and exclusive offers’. Further down the page, 

where shipping information was collected, there was a box designed for 

collecting the customers telephone number. Whilst this box did state 

the individual would receive messages from the company, a ‘question 

mark’ symbol (*?’) was contained within the box, that when hovered 

over, stated that Just Hype would only contact the customer about 

their order. Furthermore, an individual could not proceed without 


entering a number. 


Just Hype informed the Commissioner that they relied on the opt out 
box below the e-mail box to collect consent for both e-mail and text 
marketing. Individuals were led to believe that by entering their 
telephone number they would only receive contact regarding their 
order and as such, it is the Commissioners view that they would not 
reasonably expect to receive marketing. As a result, 151 complaints 
were received regarding text messages sent by Just Hype during the 


contravention period. 


In this instance Just Hype have been unable to evidence consent. From 
the evidence provided it is clear that the individuals had not, at the 
point their data was collected, been given a simple means of refusing 
the use of their contact details for direct marketing; accordingly, Just 
Hype’s direct marketing messages failed to meet the criteria of 
Regulation 22(3)(c) PECR. 


The Commissioner is therefore satisfied from the evidence she has 
seen that Just Hype did not have the necessary valid consent for the 


1,746,632 direct marketing messages received by subscribers. 
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The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 1 June 2019 and 12 June 
2020, a confirmed total of 1,746,632 direct marketing messages were 
sent at the instigation of Just Hype. These messages contained direct 
marketing material for which subscribers had not provided adequate 


consent. 


Just Hype also instigated the sending of a further 255,327 marketing 
messages. Although these were not received by individuals, it 
evidences an attempt to send large volumes of marketing messages to 


individuals without consent to do so. 


Furthermore, it is the Commissioners view that Just Hype sought to 
capitalise on the current Covid-19 health pandemic through their 
marketing. 107,795 messages were sent over a four-day period to 
individuals offering a free face mask in return for downloading Just 
Hype’s phone app. These messages accounted for 97 of the 151 


complaints received. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 
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The Commissioner does not consider that Just Hype deliberately set out 
to contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether Just Hype knew or ought 
reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
not least since the issue of unsolicited text messages has been widely 


publicised by the media as being a problem. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 

This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations 
can generally only send, or instigate, marketing emails to individuals if 
that person has specifically consented to receiving them and fully 


explains the “soft opt-in” exemption and its requirements. 


It is therefore reasonable to suppose that Just Hype should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether Just 
Hype failed to take reasonable steps to prevent the contraventions. 


Again, she is satisfied that this condition is met. 
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Such reasonable steps in these circumstances could have included 
putting in place appropriate systems, policies, and procedures to 
ensure that it had the consent of those to whom it had sent marketing 
messages. In this case the consent statement on their website was 
unclear with Just Hype relying on the “soft opt-in” exemption without 
offering a simple means for subscribers to opt out of unsolicited direct 
marketing. It would also have included ensuring that their messaging 
platform only sent messages to consented customers of Just Hype. 
Just Hype could legitimately have sought advice either from the 
Commissioner or from an independent legal advisor in relation to the 
basis on which it proposed to send its unsolicited direct marketing, 


however there is no evidence that Just Hype sought to do this. 


In the circumstances, the Commissioner is satisfied that Just Hype 


failed to take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has also taken into account the following mitigating 


feature of this case: 


Just Hype have advised the Commissioner that they have committed 
to or have implemented various steps to improve their compliance 
including updating their privacy policy to include specific reference to 
the requirements of PECR, staff training and changing their consent 


statement on their website. 
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For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 


also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by Just Hype on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on Just Hype. She has decided on the information that is 
available to her, that Just Hype has access to sufficient financial 
resources to pay the proposed monetary penalty without causing 


undue financial hardship. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited marketing emails is a matter of significant public concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses currently 
engaging in these practices. The issuing of a monetary penalty will 


reinforce the need for businesses to ensure that they are only 
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messaging those who specifically consent to receive marketing, or 


those for whom the soft opt-in exemption is applicable. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £60,000 (sixty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 18 March 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
17 March 2021 the Commissioner will reduce the monetary penalty 

by 20% to £48,000 (forty-eight thousand pounds). However, you 
should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 
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Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 15" day of February 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 


Information Commissioner's Office 


LE1 8DJ 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 
Tribunal within 28 days of the date of the notice. 


b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state:- 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the 
notice of appeal must include a request for an extension of time 


and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 6 to, 
the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 


